The WP Database Optimizer plugin for WordPress, developed by matthewprice1178, contains a CSRF vulnerability identified as CVE-2025-31474. This vulnerability affects all versions up to 1.2.1.3 and allows attackers to induce authenticated users to perform unwanted actions via crafted requests. The CVSS 3.1 base score is 4.3, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality or availability impact, and low integrity impact. No patch or remediation information is currently available.

Successful exploitation of this CSRF vulnerability could lead to unauthorized actions being performed on behalf of an authenticated user within the WP Database Optimizer plugin. The impact is limited to low integrity compromise without affecting confidentiality or availability. There are no known exploits in the wild, and the vulnerability requires user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with untrusted websites while authenticated in WordPress and consider disabling or removing the WP Database Optimizer plugin if possible to reduce risk.